AWS SAM Auto-generates Lambda Permissions even when invoke roles are specified

I am attempting to define an Authorizer within an AWS::Serverless::Api resource. The Authorizer is linked to a Lambda that is not defined in my stack and is shared across multiple stacks within our account.

It appears that SAM's default behavior is to automatically add resource-based permissions to grant my API Gateway permission to invoke the authorizer. I can see AWS::Lambda::Permission resources being created in my Cloudformation output, though none are actually defined in my template.yaml file. Normally, this behavior would be fine, however, when this occurs across multiple stacks, it causes the policy document on the shared lambda to grow to a level that eventually exceeds AWS size limits.

To work around this, I am attempting to use an IAM role to grant access to the shared lambda instead of resource-based permission. However, even when I specify a role to be used to invoke my shared lambda, SAM is still creating AWS::Lambda::Permission resources in Cloudformation.

Is there any way to prevent SAM from auto-generating these resource-based permissions?

My API definition is below. You'll note that both the FunctionInvokeRole and InvokeRole properties are set. I wouldn't expect any permission resources to be created if these properties are defined with an IAM role.

PublicGateway:
    Type: AWS::Serverless::Api
    Properties:
      StageName: latest
      EndpointConfiguration: REGIONAL
      Cors:
        AllowHeaders: '''Content-Type,Authorization,X-Amz-Date,X-Api-Key,X-Amz-Security-Token'''
        AllowMethods: '''DELETE,GET,HEAD,OPTIONS,PATCH,POST,PUT'''
        AllowOrigin: '''*'''
      Auth:
        InvokeRole:
          Fn::GetAtt:
          - MyCustomRole
          - Arn
        Authorizers:
          MyAuthorizer:
            FunctionArn:
              Fn::Sub: arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:my-shared-lambda-authorizer
            FunctionInvokeRole:
              Fn::GetAtt:
              - MyCustomRole
              - Arn
            FunctionPayloadType: REQUEST
            Identity:
              Headers:
              - Authorization
              ReauthorizeEvery: 600
        DefaultAuthorizer: MyAuthorizer
        AddDefaultAuthorizerToCorsPreflight: false
      DefinitionBody:
        Fn::Transform:
          Name: AWS::Include
          Parameters:
            Location: s3://some-s3-bucket-full-of-swagger/swagger.json
      Variables:
        stageVersion: latest